Ethical Hacking and Network Defense Chpt 1-3
A written contract isn't necessary when a friend recommends a client. True or False?
False
Antivirus software should be updated annually. True or False?
False
The Ping of Death is an exploit that sends multiple ICMP packets to a host faster than the host can handle. True or False?
False
List the six flags of a TCP packet.
SYN, ACK, PSH, URG, RST, FIN
List the three components of the TCP/IP three-way handshake.
SYN, SYN-ACK, and ACK
A UDP packet is usually smaller than a TCP packet. True or False?
True
An exploit discovered for one OS might also be effective on another OS. True or False?
True
FTP offers more security than TFTP. True or False?
True
One purpose of adware is to determine users' purchasing habits. True or False?
True
List three worms or viruses that use e-mail as a form of attack.
Waledec, Nimda, Melissa, and W32/Sobig.F
A security tester should possess which of the following attributes? (Choose all that apply.) a. Good listening skills b. Knowledge of networking and computer technology c. Good verbal and written communication skills d. An interest in securing networks and computer systems
a. Good listening skills b. Knowledge of networking and computer technology c. Good verbal and written communication skills d. An interest in securing networks and computer systems
What organization designates a person as a CISSP? a. International Information Systems Security Certification Consortium (ISC2) b. EC-Council c. SANS Institute d. GIAC
a. International Information Systems Security Certification Consortium (ISC2)
On a Windows computer, what command can you enter to show all open ports being used? a. Netstat b. Ipconfig c. Ifconfig d. Nbtstat
a. Netstat
Which command verifies the existence of a node on a network? a. Ping b. Ipconfig c. Netstat d. Nbtstat
a. Ping
An exploit that leaves an attacker with another way to compromise a network later is called which of the following? (Choose all that apply.) a. Rootkit b. Worm c. Backroot d. Backdoor
a. Rootkit d. Backdoor
Which organization issues the Top 20 list of current network vulnerabilities? a. SANS Institute b. ISECOM c. EC-Council d. OPST
a. SANS Institute
Which of the following exploits might hide its destructive payload in a legitimate application or game? a. Trojan program b. Macro virus c. Worm d. Buffer overflow
a. Trojan program
Which of the following protocols is connectionless? (Choose all that apply.) a. UDP b. IP c. TCP d. SPX
a. UDP b. IP
Which of the following doesn't attach itself to a host but can replicate itself? a. Worm b. Virus c. Trojan program d. Buffer overflow
a. Worm
Before using hacking software over the Internet, you should contact which of the following? (Choose all that apply.) a. Your ISP b. Your vendor c. Local law enforcement authorities to check for compliance d. The FBI
a. Your ISP c. Local law enforcement authorities to check for compliance
The base-64 numbering system uses bits to represent a character. a. 4 b. 6 c. 7 d. 8
b. 6
What exploit is used to elevate an attacker's permissions by inserting executable code in the computer's memory? a. Trojan program b. Buffer overflow c. Ping of Death d. Buffer variance
b. Buffer overflow
What organization offers the Certified Ethical Hacker (CEH) certification exam? a. International Information Systems Security Certification Consortium (ISC2) b. EC-Council c. SANS Institute d. GIAC
b. EC-Council
Which federal law prohibits intercepting any communication, regardless of how it was transmitted? a. Computer Fraud and Abuse Act, Title 18 b. Electronic Communication Privacy Act c. Stored Wire and Electronic Communications and Transactional Records Act d. Fourth Amendment
b. Electronic Communication Privacy Act
A software or hardware component that records each keystroke a user enters is called which of the following? a. Sniffer b. Keylogger c. Trojan program d. Buffer overflow
b. Keylogger
Which of the following is a good place to begin your search for vulnerabilities in Microsoft products? a. Hacking Web sites b. Microsoft Security Bulletins c. Newsgroup references to vulnerabilities d. User manuals
b. Microsoft Security Bulletins
The Netstat command indicates that POP3 is in use on a remote server. Which port is the remote server most likely using? a. Port 25 b. Port 110 c. Port 143 d. Port 80
b. Port 110
What port, other than port 110, is used to retrieve e-mail? a. Port 25 b. Port 143 c. Port 80 d. Port 135
b. Port 143
A Ping command initially uses which ICMP type code? a. Type 0 b. Type 8 c. Type 14 d. Type 13
b. Type 8
A computer relies on a host to propagate throughout a network. a. Worm b. Virus c. Program d. Sniffer
b. Virus
Which of the following is not a valid octal number? a. 5555 b. 4567 c. 3482 d. 7770
c. 3482
A penetration tester is which of the following? a. A person who accesses a computer or network without permission from the owner b. A person who uses telephone services without payment c. A security professional who's hired to hack into a network to discover vulnerabilities d. A hacker who accesses a system without permission but does not delete or destroy files
c. A security professional who's hired to hack into a network to discover vulnerabilities
What portion of your ISP contract might affect your ability to conduct a penetration test over the Internet? a. Scanning policy b. Port access policy c. Acceptable use policy d. Warranty policy
c. Acceptable use policy
What protocol is used for reporting or informational purposes? a. IGMP b. TCP c. ICMP d. IP
c. ICMP
Some experienced hackers refer to inexperienced hackers who copy or use prewritten scripts or programs as which of the following? (Choose all that apply.) a. Script monkeys b. Packet kiddies c. Packet monkeys d. Script kiddies
c. Packet monkeys d. Script kiddies
To determine whether scanning is illegal in your area, you should do which of the following? a. Refer to U.S. code. b. Refer to the U.S. Patriot Act. c. Refer to state laws. d. Contact your ISP.
c. Refer to state laws.
Which protocol offers guaranteed delivery and is connection oriented? a. UDP b. IP c. TCP d. TFTP
c. TCP
What command is used to log on to a remote server, computer, or router? a. Ping b. Traceroute c. Telnet d. Netstat
c. Telnet
"Destination Unreachable" is designated by which ICMP type code? a. Type 0 b. Type 14 c. Type 3 d. Type 8
c. Type 3
The initial sequence number (ISN) is set at which step of the TCP three-way handshake? a. 1, 2, 3 b. 1, 3 c. 1 d. 1 and 2
d. 1 and 2
To reduce the risk of a virus attack on a network, you should do which of the following? a. Use antivirus software. b. Educate users about opening attachments from suspicious e-mail. c. Keep virus signature files current. d. All of the above
d. All of the above
What type of network attack relies on multiple servers participating in an attack on one host system? a. Trojan attack b. Buffer overflow c. Denial-of-service attack d. Distributed denial-of-service attack
d. Distributed denial-of-service attack
If you run a program in New York City that uses network resources to the extent that a user is denied access to them, what type of law have you violated? a. City b. State c. Local d. Federal
d. Federal
What component can be used to reduce the risk of a Trojan program or rootkit sending information from an attacked computer to a remote host? a. Base-64 decoder b. Keylogger c. Telnet d. Firewall
d. Firewall
What organization designates a person as an OPST? a. International Information Systems Security Certification Consortium (ISC2) b. EC-Council c. SANS Institute d. ISECOM
d. ISECOM
TCP communication could be likened to which of the following? a. Announcement over a loudspeaker b. Bullhorn at a sporting event c. Internet traffic d. Phone conversation
d. Phone conversation
What port does DNS use? a. Port 80 b. Port 69 c. Port 25 d. Port 53
d. Port 53
A team composed of people with varied skills who attempt to penetrate a network is referred to as which of the following? a. Green team b. Blue team c. Black team d. Red team
d. Red team
Which protocol uses UDP? a. FTP b. Netstat c. Telnet d. TFTP
d. TFTP
Which federal law amended Chapter 119 of Title 18, U.S. Code? a. Computer Fraud and Abuse Act, Title 18 b. Electronic Communication Privacy Act c. Stored Wire and Electronic Communications and Transactional Records Act d. U.S. Patriot Act, Sec. 217: Interception of Computer Trespasser Communications
d. U.S. Patriot Act, Sec. 217: Interception of Computer Trespasser Communications
Which of the following is an example of a macro programming language? a. Cþþ b. Windows XP c. Visual Basic d. Visual Basic for Applications
d. Visual Basic for Applications
List three types of malware
viruses, worms, Trojan programs, adware, and spyware
What three models do penetration or security testers use to conduct tests?
white box, black box, gray box
The U.S. Department of Justice defines a hacker as which of the following? a. A person who accesses a computer or network without the owner's permission b. A penetration tester c. A person who uses telephone services without payment d. A person who accesses a computer or network system with the owner's permission
a. A person who accesses a computer or network without the owner's permission
An exploit that attacks computer systems by inserting executable code in areas of memory not protected because of poorly written code is called which of the following? a. Buffer overflow b. Trojan program c. Virus d. Worm
a. Buffer overflow
As a security tester, what should you do before installing hacking software on your computer? a. Check with local law enforcement agencies. b. Contact your hardware vendor. c. Contact the software vendor. d. Contact your ISP.
a. Check with local law enforcement agencies.
Which federal law prohibits unauthorized access of classified information? a. Computer Fraud and Abuse Act, Title 18 b. Electronic Communication Privacy Act c. Stored Wire and Electronic Communications and Transactional Records Act d. Fifth Amendment
a. Computer Fraud and Abuse Act, Title 18
How can you find out which computer crime laws are applicable in your state? a. Contact your local law enforcement agencies. b. Contact your ISP provider. c. Contact your local computer store vendor. d. Call 911.
a. Contact your local law enforcement agencies.
What is the main purpose of malware? a. Doing harm to a computer system b. Learning passwords c. Discovering open ports d. Identifying an operating system
a. Doing harm to a computer system
What's the hexadecimal equivalent of the binary number 1111 1111? a. FF b. 255 c. EE d. DD
a. FF